bytifi 0.2.5 → 0.2.7

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Bytifi
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -45,7 +45,8 @@ Create an API key in **Account → API** on bytifi.com.
 ## Setup
 
 Set your API key via environment variable (see Install above) or pass `--api-key` per command.
-Prefer the environment variable — keys on the command line can appear in shell history and process lists.
+
+**Security:** Prefer `BYTIFI_API_KEY` over `--api-key` on the command line. API keys and encryption tokens passed as CLI flags may appear in shell history and process lists (`ps`). The CLI warns when secrets are passed on argv.
 
 ## Usage
 
@@ -59,7 +60,9 @@ bytifi upload ./logs.txt --concurrency 8 --json > upload.json
 bytifi upload ./photo.png -q
 ```
 
-Files up to **10 MB** are gzip-compressed per chunk before encryption. Larger files use multipart upload with fixed-size encrypted parts (no compression — gzip can expand ISO/zip data past the server part limit).
+Files up to **10 MB** use a single direct upload with gzip-compressed chunks. Files **over 10 MB** use multipart upload with fixed-size encrypted parts (no compression — gzip can expand ISO/zip data past the server part limit).
+
+Upload concurrency auto-scales when `--concurrency` is omitted: ≤1 GB → 4 workers, 1–3 GB → 3 workers, ≥3 GB → 2 workers.
 
 Upload accepts **one file at a time**. Quote paths that contain spaces. Avoid shell globs like `**` — your shell may expand them into dozens of paths.
 
@@ -70,6 +73,7 @@ Download and decrypt directly from a share URL or link token. No API key require
 ```bash
 bytifi decrypt 'https://bytifi.com/link?link=LINK_ID#token=ENCRYPTION_TOKEN'
 bytifi decrypt LINK_ID --token ENCRYPTION_TOKEN -o ./restored.mp4
+bytifi decrypt LINK_ID --token ENCRYPTION_TOKEN --concurrency 4
 ```
 
 ### Decrypt a downloaded encrypted file
@@ -84,6 +88,12 @@ bytifi decrypt ./downloaded-file --upload-json upload.json
 bytifi decrypt "./my video (1).mp4" \
   --link LINK_ID \
   --token ENCRYPTION_TOKEN
+
+# Force local-path mode when the filename looks like a URL
+bytifi decrypt ./https-example.bin --local-file --upload-json upload.json
+
+# Overwrite an existing output file
+bytifi decrypt ./downloaded-file --upload-json upload.json --force
 ```
 
 #### Link ID vs encryption token
@@ -128,7 +138,7 @@ Note: with `npm exec`, put `--` before the file path so npm does not swallow `--
 | `-q, --quiet` | Print only the share URL |
 | `--verbose` | Print API error details to stderr |
 | `--mime-type` | Override detected MIME type |
-| `--concurrency` | Parallel encrypt/upload workers, 1–16 (default: `4`) |
+| `--concurrency` | Parallel encrypt/upload workers, 1–16 (default: auto-scaled by file size) |
 | `--base-url` | API base URL (default: `https://bytifi.com`) |
 
 ### Decrypt options
@@ -140,24 +150,28 @@ Note: with `npm exec`, put `--` before the file path so npm does not swallow `--
 | `--upload-json` | Upload `--json` output file (recommended for downloaded files) |
 | `--meta` | Saved `clientEncryptionMeta` JSON for offline decrypt |
 | `--share-url` | Share URL to read token/metadata while decrypting a local file |
+| `--local-file` | Treat input as a local path even if it looks like a URL |
 | `-o, --output` | Output file path |
 | `--output-dir` | Output directory when saving under the original filename |
+| `--force` | Overwrite existing output file |
+| `--concurrency` | Parallel part download workers, 1–8 (default: `2`) |
 | `--json` | Machine-readable JSON output |
 | `-q, --quiet` | Print only the output file path |
 | `--verbose` | Print error details to stderr |
 | `--base-url` | API base URL (default: `https://bytifi.com`) |
 
-Exit codes: `0` success, `1` usage error, `2` API error, `3` network error.
+Exit codes: `0` success, `1` usage error, `2` API error, `3` network error, `130` interrupted (Ctrl+C).
 
 JSON output (`--json`) for upload includes `shareUrl`, `encryptedFile`, `link`, `encryptionToken`, `clientEncryptionMeta`, `compression`, and `expiresAt`.
 
 JSON output for decrypt includes `outputPath`, `originalName`, `size`, `mimeType`, `expiresAt`, `link`, `storageMode`, and `sourcePath` (for local decrypt).
 
-Files over ~100 MB encrypted use multipart upload automatically. Progress prints to stderr unless `--json` or `--quiet` is set.
+Progress prints to stderr with throughput and ETA unless `--json` or `--quiet` is set.
 
 ## Development
 
 ```bash
+npm test
 node bin/bytifi.js upload ./file.png --json > upload.json
 node bin/bytifi.js decrypt ./file.encrypted --upload-json upload.json
 ```

package/bin/bytifi.js

@@ -5,7 +5,8 @@ import path from 'node:path'
 import process from 'node:process'
 import { createRequire } from 'node:module'
 import { decryptFile } from '../lib/decrypt.js'
-import { formatProgressLine } from '../lib/progress.js'
+import { createProgressTracker, formatProgressLine } from '../lib/progress.js'
+import { validateBaseUrl } from '../lib/url.js'
 import { BytifiApiError, BytifiNetworkError, uploadFile } from '../lib/upload.js'
 
 const require = createRequire(import.meta.url)
@@ -14,15 +15,41 @@ const version =
     ? __BYTIFI_VERSION__
     : require('../package.json').version
 
-function printHelp() {
+const SECRET_FLAGS = new Set(['--api-key', '-k', '--token'])
+
+function printGlobalHelp() {
   process.stdout.write(`Bytifi CLI v${version} — encrypt, upload, and decrypt files
 
 Usage:
   bytifi upload <file> [options]
-  bytifi decrypt <url-or-token> [options]
-  bytifi decrypt <encrypted-file> [options]
+  bytifi decrypt <input> [options]
+
+Commands:
+  upload    Encrypt and upload a file
+  decrypt   Decrypt from a share link or local encrypted file
+
+Global:
+  -V, --version             Show version
+  -h, --help                Show help
+
+Run \`bytifi upload --help\` or \`bytifi decrypt --help\` for command options.
+
+Exit codes:
+  0   success
+  1   usage or validation error
+  2   API error (4xx/5xx response)
+  3   network error
+  130 interrupted (Ctrl+C)
+`)
+}
+
+function printUploadHelp() {
+  process.stdout.write(`Bytifi upload — encrypt and upload a file
+
+Usage:
+  bytifi upload <file> [options]
 
-Upload options:
+Options:
   -k, --api-key <key>       API key (default: BYTIFI_API_KEY env var)
   -e, --expires <minutes>   Link lifetime: 5|15|30|60|120 (default: 30)
       --delete-on-download  Remove file after first download
@@ -30,43 +57,49 @@ Upload options:
   -q, --quiet               Print only the share URL
       --verbose             Show API error details on stderr
       --mime-type <type>    Override detected MIME type
-      --concurrency <n>     Parallel part workers (default: 4)
+      --concurrency <n>     Parallel part workers, 1–16 (default: auto)
       --base-url <url>      API base URL (default: https://bytifi.com)
+  -h, --help                Show this help
+
+Concurrency auto-scales by file size when --concurrency is omitted:
+  ≤1 GB → 4 workers, 1–3 GB → 3 workers, ≥3 GB → 2 workers.
+
+Examples:
+  export BYTIFI_API_KEY=usk_your_key
+  bytifi upload ./photo.png
+  bytifi upload "./my report.pdf" --expires 60 --delete-on-download
+  bytifi upload ./logs.txt --concurrency 8 --json > upload.json
+  bytifi upload ./large.iso -q
+`)
+}
+
+function printDecryptHelp() {
+  process.stdout.write(`Bytifi decrypt — decrypt from a link or local encrypted file
 
-Decrypt options:
+Usage:
+  bytifi decrypt <url-or-token|encrypted-file> [options]
+
+Options:
       --token <token>       Encryption key from #token=... (not the link ID)
       --link <id>           Link ID from upload JSON "link" field (/f/LINK_ID)
       --upload-json <path>  Upload --json output (easiest for downloaded files)
       --meta <path>         Saved clientEncryptionMeta JSON (offline decrypt)
-      --share-url <url>     Share URL for token/metadata when decrypting a local file
+      --share-url <url>     Share URL for token/metadata when decrypting locally
+      --local-file          Treat input as a local path even if it looks like a URL
   -o, --output <path>       Output file path (default: original filename)
       --output-dir <dir>    Directory for decrypted file (default: cwd)
+      --force               Overwrite existing output file
+      --concurrency <n>     Parallel download workers, 1–8 (default: 2)
       --json                Print machine-readable JSON to stdout
   -q, --quiet               Print only the output file path
       --verbose             Show error details on stderr
       --base-url <url>      API base URL (default: https://bytifi.com)
-
-Global:
-  -V, --version             Show version
   -h, --help                Show this help
 
-Exit codes:
-  0  success
-  1  usage or validation error
-  2  API error (4xx/5xx response)
-  3  network error
-
 Examples:
-  bytifi --version
-  export BYTIFI_API_KEY=usk_your_key
-
-  bytifi upload ./photo.png
-  bytifi upload "./my report.pdf" --expires 60 --delete-on-download
-  bytifi upload ./logs.txt --concurrency 8 --json > upload.json
-  bytifi upload ./large.iso -q
-
   bytifi decrypt 'https://bytifi.com/link?link=LINK#token=KEY'
   bytifi decrypt ./downloaded.bin --upload-json upload.json -o ./restored.bin
+  bytifi decrypt ./parts-dir/ --upload-json upload.json --force
 `)
 }
 
@@ -88,7 +121,7 @@ function parseUploadArgs(argv) {
     quiet: false,
     verbose: false,
     mimeType: '',
-    concurrency: 4,
+    concurrency: null,
     baseUrl: 'https://bytifi.com',
     help: false,
     version: false,
@@ -187,6 +220,9 @@ function parseDecryptArgs(argv) {
     shareUrl: '',
     output: '',
     outputDirectory: '',
+    localFile: false,
+    force: false,
+    concurrency: 2,
     json: false,
     quiet: false,
     verbose: false,
@@ -223,6 +259,16 @@ function parseDecryptArgs(argv) {
       continue
     }
 
+    if (arg === '--force') {
+      options.force = true
+      continue
+    }
+
+    if (arg === '--local-file') {
+      options.localFile = true
+      continue
+    }
+
     if (arg === '--token') {
       options.encryptionToken = readFlagValue(argv, index, arg)
       index += 1
@@ -265,6 +311,17 @@ function parseDecryptArgs(argv) {
       continue
     }
 
+    if (arg === '--concurrency') {
+      const raw = readFlagValue(argv, index, arg)
+      const concurrency = Number(raw)
+      if (!Number.isInteger(concurrency) || concurrency < 1 || concurrency > 8) {
+        throw new Error('concurrency must be an integer between 1 and 8.')
+      }
+      options.concurrency = concurrency
+      index += 1
+      continue
+    }
+
     if (arg === '--base-url') {
       options.baseUrl = readFlagValue(argv, index, arg)
       index += 1
@@ -281,6 +338,18 @@ function parseDecryptArgs(argv) {
   return { positional, options }
 }
 
+function warnSecretFlags(argv) {
+  for (let index = 0; index < argv.length; index += 1) {
+    const arg = argv[index]
+    if (SECRET_FLAGS.has(arg)) {
+      process.stderr.write(
+        `Warning: ${arg} on the command line may appear in shell history and process lists. Prefer BYTIFI_API_KEY for uploads.\n`,
+      )
+      return
+    }
+  }
+}
+
 function validateExpires(minutes) {
   const allowed = new Set([5, 15, 30, 60, 120])
   if (!allowed.has(minutes)) {
@@ -288,8 +357,7 @@ function validateExpires(minutes) {
   }
 }
 
-function writeProgress(info) {
-  const line = formatProgressLine(info)
+function writeProgress(line) {
   if (line) {
     process.stderr.write(`\r${line}`)
   }
@@ -303,31 +371,52 @@ function clearProgressLine() {
   process.stderr.write('\r\x1b[K')
 }
 
+function createAbortContext(label) {
+  const abortController = new AbortController()
+  let abortedByUser = false
+
+  const handleSignal = () => {
+    abortedByUser = true
+    abortController.abort()
+  }
+
+  process.on('SIGINT', handleSignal)
+  process.on('SIGTERM', handleSignal)
+
+  return {
+    signal: abortController.signal,
+    cleanup() {
+      process.off('SIGINT', handleSignal)
+      process.off('SIGTERM', handleSignal)
+    },
+    checkAborted() {
+      if (abortedByUser || abortController.signal.aborted) {
+        clearProgressLine()
+        process.stderr.write(`${label} aborted.\n`)
+        process.exit(130)
+      }
+    },
+  }
+}
+
 async function runUpload(filePath, options) {
   validateExpires(options.expiresInMinutes)
+  options.baseUrl = validateBaseUrl(options.baseUrl)
 
   if (!options.apiKey) {
     throw new Error('Missing API key. Pass --api-key or set BYTIFI_API_KEY.')
   }
 
   const resolvedPath = path.resolve(filePath)
+  const stat = await fs.stat(resolvedPath)
 
-  try {
-    await fs.access(resolvedPath)
-  } catch {
-    throw new Error(`File not found or not readable: ${resolvedPath}`)
-  }
-
-  const abortController = new AbortController()
-
-  const handleSignal = () => {
-    abortController.abort()
+  if (!stat.isFile()) {
+    throw new Error(`Upload path must be a file: ${resolvedPath}`)
   }
 
-  process.on('SIGINT', handleSignal)
-  process.on('SIGTERM', handleSignal)
-
+  const abort = createAbortContext('Upload')
   const showProgress = !options.quiet && !options.json
+  const tracker = createProgressTracker()
   let lastLine = ''
 
   try {
@@ -337,19 +426,22 @@ async function runUpload(filePath, options) {
       expiresInMinutes: options.expiresInMinutes,
       deleteOnDownload: options.deleteOnDownload,
       mimeType: options.mimeType || undefined,
-      concurrency: options.concurrency,
-      signal: abortController.signal,
+      concurrency: options.concurrency ?? undefined,
+      signal: abort.signal,
       onProgress: showProgress
         ? (info) => {
-            const line = formatProgressLine(info)
+            const enriched = tracker.update(info)
+            const line = formatProgressLine(enriched)
             if (line && line !== lastLine) {
               lastLine = line
-              writeProgress(info)
+              writeProgress(line)
             }
           }
         : undefined,
     })
 
+    abort.checkAborted()
+
     if (showProgress) {
       finishProgressLine()
     }
@@ -367,23 +459,20 @@ async function runUpload(filePath, options) {
     process.stdout.write(`Share URL:\n${result.shareUrl}\n`)
     process.stdout.write(`Encrypted file:\n${result.encryptedFile}\n`)
     process.stdout.write(`Expires: ${result.expiresAt}\n`)
+  } catch (error) {
+    abort.checkAborted()
+    throw error
   } finally {
-    process.off('SIGINT', handleSignal)
-    process.off('SIGTERM', handleSignal)
+    abort.cleanup()
   }
 }
 
 async function runDecrypt(input, options) {
-  const abortController = new AbortController()
-
-  const handleSignal = () => {
-    abortController.abort()
-  }
-
-  process.on('SIGINT', handleSignal)
-  process.on('SIGTERM', handleSignal)
+  options.baseUrl = validateBaseUrl(options.baseUrl)
 
+  const abort = createAbortContext('Decrypt')
   const showProgress = !options.quiet && !options.json
+  const tracker = createProgressTracker()
   let lastLine = ''
 
   try {
@@ -395,19 +484,25 @@ async function runDecrypt(input, options) {
       shareUrl: options.shareUrl,
       output: options.output || undefined,
       outputDirectory: options.outputDirectory || undefined,
+      localFile: options.localFile,
+      force: options.force,
+      concurrency: options.concurrency,
       baseUrl: options.baseUrl,
-      signal: abortController.signal,
+      signal: abort.signal,
       onProgress: showProgress
         ? (info) => {
-            const line = formatProgressLine(info)
+            const enriched = tracker.update(info)
+            const line = formatProgressLine(enriched)
             if (line && line !== lastLine) {
               lastLine = line
-              writeProgress(info)
+              writeProgress(line)
             }
           }
         : undefined,
     })
 
+    abort.checkAborted()
+
     if (showProgress) {
       finishProgressLine()
     }
@@ -425,9 +520,11 @@ async function runDecrypt(input, options) {
     process.stdout.write(`Saved: ${result.outputPath}\n`)
     process.stdout.write(`Original name: ${result.originalName}\n`)
     process.stdout.write(`Expires: ${result.expiresAt}\n`)
+  } catch (error) {
+    abort.checkAborted()
+    throw error
   } finally {
-    process.off('SIGINT', handleSignal)
-    process.off('SIGTERM', handleSignal)
+    abort.cleanup()
   }
 }
 
@@ -457,10 +554,13 @@ function printError(error, verbose) {
 }
 
 async function main() {
-  const [command, ...rest] = process.argv.slice(2)
+  const argv = process.argv.slice(2)
+  warnSecretFlags(argv)
+
+  const [command, ...rest] = argv
 
   if (!command || command === '--help' || command === '-h') {
-    printHelp()
+    printGlobalHelp()
     process.exit(0)
   }
 
@@ -470,7 +570,7 @@ async function main() {
   }
 
   if (command === 'help') {
-    printHelp()
+    printGlobalHelp()
     process.exit(0)
   }
 
@@ -478,7 +578,7 @@ async function main() {
     const { positional, options } = parseUploadArgs(rest)
 
     if (options.help) {
-      printHelp()
+      printUploadHelp()
       process.exit(0)
     }
 
@@ -510,7 +610,7 @@ async function main() {
     const { positional, options } = parseDecryptArgs(rest)
 
     if (options.help) {
-      printHelp()
+      printDecryptHelp()
       process.exit(0)
     }
 
@@ -529,7 +629,9 @@ async function main() {
     }
 
     if (positional.length > 1) {
-      process.stderr.write(`Warning: ignoring extra arguments: ${positional.slice(1).join(', ')}\n`)
+      throw new Error(
+        `Decrypt accepts one input at a time (got ${positional.length}). Quote paths with spaces.`,
+      )
     }
 
     await runDecrypt(input, options)